Use visualizations in Splunk Light

When you create a dashboard panel, you select how the panel displays the results of a search or report with a visualization. Visualizations are graphical representations of your data, such as a graph, table, or chart. You can change your visualization selection with the Dashboard Panel Editor.

For information about visualizations types, see the Visualization Reference in the Splunk Enterprise Dashboards and Visualizations manual.

Add a visualization to a search and save as a dashboard panel

When you run a search, the visualization tab on the Search page lists visualizations that represent your data based upon your search results. Select a visualization and save the search and visualization as a dashboard panel.

1. After running a search, select the Visualization tab on the Search page.
2. Click the Visualization Picker, which is the menu that lists available visualizations.
3. Select a visualization. The Splunk Light software suggests Recommended visualizations that best represent your data, although you can select any visualization listed.
4. Select Save As > Dashboard Panel to save your search and visualization as a dashboard panel.

Change a visualization on a dashboard panel

Change a visualization on a dashboard panel by editing the panel.

1. On a dashboard, click Edit.
2. On the dashboard panel, click the Visualization Picker and select a visualization. The recommended visualizations best represent your data, although you can select any visualization listed.
3. Click Save.

Edit visualizations using the Dashboard Editor

Edit a visualization to configure its search, type, appearance, and behavior. You can edit visualizations from the Panel Editor or on the Search page. In either location, you can adjust the following visualization components.

Visualization components	Description
Search string	Use the dashboard search editor or the search bar to change the query driving the visualization.
Type	Use the Visualization Picker to select a visualization type. Ensure that the query generates results in the proper structure for the selected visualization.
Format and behavior	Use the Format menu to adjust appearance, drilldown, and other settings for the visualization's user interface.

Formatting and other options vary by visualization type. To compare visualizations and for details about writing queries for different visualizations, see the Visualization reference and Data structure requirements for visualizations in the Splunk Enterprise Dashboards and Visualizations manual.

Add event annotations to a chart

Event annotations allow you to create context for existing line, column, or area charts. When you use annotations, event flags are overlaid onto the chart as a result of a secondary search of a log file, a lookup, or from a data source you've manually added. These secondary annotation searches can only be added in Simple XML while editing a dashboard or panel using the Source option. The secondary search is run at the dashboard level, not at the search level. The following image is an example of a dashboard panel that includes event annotations.

For more information on using event annotations, such as a table of fields that can be used, field requirements, and an example of the XML used to create the dashboard above, please see Event annotations for charts.

View, export, inspect or refresh a visualization

In the Panel Editor you can access and view details of the search that drives the data in a panel. These features are available from icons that are visible when you mouse-over the bottom right of a panel.

Panel Editor components	Description
Open the Search	You can open a search for a visualization in Search. This is useful to inspect details of the search and perhaps test modifications to it before updating the search in the panel. In the Panel Editor, click the Open in Search icon. A new window opens with the search running in the Search.
Export	You can save the results of the search, or a limited set of results, to a file. In the Panel Editor, click the Export icon and specify the format, filename, and number of results to export. Click Export.
Inspect	Use the Search Job Inspector to view details of the search. In the Panel Editor, click the Inspect icon. The Search job inspector opens in a new window. In the Panel Editor, click the Inspect icon. The Search Job Inspector opens in a new window.
Refresh	You can refresh the results for a search in a panel. This is useful to verify that you are seeing the latest results. In the Panel Editor, click the Refresh icon.